CVE-2026-98245

btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

State: Published
Severity: Not scored
Published: Oct 6, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

mark_block_group_to_copy() iterates over the commit root with skip_locking=true. A concurrent transaction commit can swap and free the commit root during iteration, causing use-after-free when accessing extent buffers.

Fix it by using path->need_commit_sem to protect the commit root search.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 90242b776df83f8b1ea901f80b568b4fc2318c61Affected 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before bffe773f92885603db14047bba0f12089105929eAffected 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 93a025166495c63ba5b8ac721c7040d5312e8335Affected 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 8e2007b263ea250251ec3021a0a197da990ee1a8Affected 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 709f6a5e986535005110c6c69b322f63631cb200Affected 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before c32490c6d3f3a9f2d177d57c7eb8bbc347561d08Affected 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 0594e3423f4ba3137c734371169491f9a98e9af4Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 90242b776df83f8b1ea901f80b568b4fc2318c61Affected
78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before bffe773f92885603db14047bba0f12089105929eAffected
78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 93a025166495c63ba5b8ac721c7040d5312e8335Affected
78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 8e2007b263ea250251ec3021a0a197da990ee1a8Affected
78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 709f6a5e986535005110c6c69b322f63631cb200Affected
78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before c32490c6d3f3a9f2d177d57c7eb8bbc347561d08Affected
78ce9fc269af6e69c1399ab910ba6bc81c934f67 to before 0594e3423f4ba3137c734371169491f9a98e9af4Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.